Domain: linuxsupportline.com
Stories and comments across the archive that link to linuxsupportline.com.
Comments · 86
-
Great way to make money here!
Step 1. Invent some kind of poor encryption.
Step 2. Make a contest to break it.
Step 3. Everyone who steps up to claim the prize, sue them!
This page was generated with the help of DOC++. -
Actually it is better than $75.00
Small claims can have an affect on a company. In many states, probably CA as well, a corporation needs legal representation for small claims court, while an individual can represent themselves. While you have to waste some of your time, the corporation has to pay for a lawyer to represent it.This page was generated with the help of DOC++.
-
Re:That's BS - Here's a cheap firewall for you
-
Re:Obvious, but not for the reasons everyone think
For the sake of all those who want to actually read about these concepts at a level thats understandable to someone with any schooling, see my favorite books page and pick up Schrodinger's Kittens or Why quantum physics is strange, but not as strange as you think.
-
Re:C-Doc
DOC++ is a nice one I've used for C++ code (also works for Java). I'm a little surprised that they broke with the JavaDoc's (and DOC++, and others') convention of starting documentation comments with "/**" or "///", though.
-
Re: No more protocols!
Everyone does of course realise that developing another protocol (of which there are at least three in development that I know of) will simply be another protocol? It won't be the take-over one, it will just add to the mess.
What we need are good clients using well-written libraries for each of these types of IM systems. This is more complicated than people realise, but still appropriate and possible.
Note: I'm biased as the maintainer of libicq. -
Re:Hopefully...
This can't really be called incompetence, as anyone capable of the lengths necessary to do this probably is capable of pretty much anything web-related. This here was a case of bad web design philosophy. The people who do this are highly-educated, technically-skilled, not-incompetent, fucking idiots.
Quite well said, I must say. In my experience, these people are quite intelligent, as you mention, and are completely clueless w.r.t. why people wouldn't "just use the latest and greatest?"
I have a cable modem -- I don't design my website arounda cable modem. I've tried to make my page browser-friendly with a mix of javascript and <noscript> tags.
I went to a site that had used an animated GIF for an intro screen (ACC Telecommunications - no longer there) that was over 80k and I optimised it down to 22k (same quality) with Gifsicle. I E-mailed it to them and they actually used it.
Fox, on the other hand, doesn't even seem to notice its E-mail (as the reporter mentions re: their phone calls to the technical people in the article). Not paying attention to customers is going to kill any company, on any front.
Technical (in)competance aside, I think we (the community) should be trying to get the attention of the major web design firms and authors (websites re: design, like Webmonkey) to realise the truths of webdesign that we've mentioned.
I've got a couple comments on my new web design page, but nothing sophisticated enough. Yet.
Lets win this by making awareness ... -
Re:Common misconception of what "theories" are.Just a facts update
... here's a link to read:
http://www.campusfreethought.org/sos/
This is the "Save our Science / Save our Schools" campaign. It is to eliminate Creationism from school curricula (as it is currently being introduced).
- Michael T. Babcock <homepage> -
Re:Success will be limited
Linux lacks organized and official testing, and it lacks paid engineers who make their living improving it. People are expected to fix bugs for free. But this is the real world, and people only do so much bona fide work.
Do a poll: if network admins could fix bugs as they came up, would they? The people who did the 3D water effects for the Titanic movie used a huge Linux cluster for processing. The kernel had limitations on the Alpha platform that prevented it from working right, but considering the money they'd saved over an NT based solution, they just put some ressources into making it work properly (and better than NT). Everyone now has a more stable Alpha platform.
As for documentation and some of the other comments you've made, the man pages and other Linux documentation are often more complete and more TRUE than MS' documentation on any given issue.
- Michael T. Babcock <homepage> -
Re:You're pulling our collective leg, right? (-:
Have you actually read any science texts or even popular books in the last 30 years? They almost universally begin by assuming that evolution is a fact, even when they actually say "theory", then scrabble around trying to support their assumption. Many of them have phrases like "the fact of evolution" dotted around.
Then you've been reading some pretty crappy books, is all I can say. :) Actually, I can say one more thing.. Because of the stigma about the word "theory", some scientists may occassionally use the word "fact" to refer to scientific theories.. nonetheless, these "facts" are still as subject to scientific inquiry as anything else.
Mind you, the whole point of this thread was that teachers need to be given better materials to work with or else them being up to date will not be relevant to the students reading these text books. If you think the books are pretty bad ... good; say so to someone who can change what kind of science books are in grade schools, high schools, etc. They just don't bother with accuracy or intelligence any more, they take the books with the best pictures, etc.
- Michael T. Babcock <homepage> -
Re:non-Flame
You obviously need to re-read the post a few times. The reporting of historical truth that they measured the diameter at one length and the circumferance at that length * 3 may indeed be accurate. The Bible teaches that those were the measurements made by those people at that time, using the tools they had
...
... like he said, go grab a piece of play-doh and mould it into a hand-made circle ... (without modern tools!) and then measure ... give us measurements using a piece of string 1 inch long (for scale's sake ... unless you want a 30 cubit piece of play-doh ... ).
We all understand significant digits here? Why would the people reporting the measurements have been concerned about measurements beyond the significance they were dealing with? We're measuiring in CUBITS ... that's like "how many miles between NYC and TORONTO?" ... well, better get it to a meter's precision! :)
No, the Bible teaches a historical situation in which those are the measurements given. Unless Moses got up and said "God has taught us the concept of CIRCLE! ... listen! ... it is to be 3 times further around than it is wide! ..." it is not "Bible teaching" ...
... ask a Bible scholar.
And, BTW, for the philosophers out there ... you don't attack a system without using that system's presuppositions ... because those being attacked take all of their presuppositions to be true, not just that one plus all of your own :-). If ALL presuppositions are considered, do the facts still end up making a falsehood? No, not in this case.
- Michael T. Babcock <homepage> -
Re:Poking holes
Umm, no the Bible does not say PI is 3
... it uses dimensions that have enough precision to be considered correct (seeing as no-one making the criticism can give me the exact value of PI ... oops, wrong number to pick an argument about). Considering the time period, an estimated value of 3 for the sake of making measurements and not transcribing values in decimal form (which didn't exist for Hebrew numbering) is perfectly acceptable.
We're talking a historical narrative people, has no one here studied Hermeneutics as much as Insolence? :-) ... the accuracy of the Bible is debated on the valid levels of historical truth, claim accuracy, etc. However, because it reports that a measurement was made, and these are the numbers within the system given does not make it inaccurate, but thanks for starting an off-topic thread :-).
- Michael T. Babcock <homepage> -
Re:Creationism (long and very OT)
Yes, semantics. And scientists should care as much about how they use terms as anyone else. You cannot discount a creationist's comment that "evolution is just a theory" (of how things got to be how they are) by saying "gravity is just a theory too" when in fact, it isn't.
We KNOW that things are how they are (although not everything about them ... like the exact density of Jupiter ... )
We KNOW that things are attracted to each other on large-mass scale ... (gravity).
We don't know WHY either of these things is the way it is ... but we theorise about them. To throw out "just semantics" is discounting the point.
- Michael T. Babcock <homepage> -
Re:remember Feynman?
I'm surprised people even consider themselves to be scientific when they discount theories with such staunch and dogmatic comments as your own.
Have fun ... with "reality".
- Michael T. Babcock <homepage> -
Re:Common misconception of what "theories" are.
I enjoyed your lecture, but none of it was directed at me, but rather the persona you gave me before beginning. I understand who your intended audience was, but I am not a member of the given audience.
My exact words, as you quoted them, were that the average ... scientist believes in evolution. I did not make the faulty claim that all scientists take evolution to be fact but rather the former. We both understand that there are conflicting theories about many things. String theory is one of many theories of meta(-ish-)physics going around today but many of these are difficult to prove (as is evolution).
My request was not that only facts be taught but rather that if a theory is a theory, not fact, that it be taught as a theory (sorry to quote myself again).
I always thought that a good scientist would also be good at sourcing his or her material, but I guess you're neither as you misrepresented me twice.
- Michael T. Babcock <homepage> -
Re:Lead paint is nice
But no one would know it was dangerous if it weren't for government institutions or funding proving that it was. My dad works in research and testing for the Canadian Safety Council branch of Canadian Health Services. You can't imagine how many dangerous products try to get to market so the creator can save some money and consumers have no way of knowing about it. Can you imagine if lead paint was labelled like cigarettes, instead of being banned for household use, etc.?
"Use of this paint may cause insanity, sickness and death"
People still smoke, don't they?
- Michael T. Babcock <homepage> -
Re:remember Feynman?
I enjoyed your hidden agenda slam against creationists. They of course would say that you have to be careful of the textbooks that claim that any theory is proven unless it actually is. Just because the average humanist scientist believes in evolution doesn't mean it should be taught as fact, but rather as a plausible theory.
Part of the problem with education these days is the filling of any agenda, rather than focussing on good education; teaching kids to think. We have focussed for years on making people learn well, rather than making them think well. The average person in college can do research if they have to, but they can't process it into new and useful information.
Thinking is valuable ... but its a danger to the establishment.
....
Oh no, a creationist who is anti-establishment?
- Michael T. Babcock <homepage> -
Re: Good euros
So, unlike your comments w.r.t. MP3 copying, you now believe that certain companies don't have the right to do anything they wish (utilities)?
At any rate, you ignored my comments outright -- no, consumers would buy lead paint because they did long before it was banned ...
- Michael T. Babcock <homepage> -
Re:God this section of Slashdot gets old quick...
Well, since unsigned bands aren't represented by the RIAA, I'm sure they don't care about those MP3s. Obviously they are going after pirated music, which is their right under the law. So some kids who are stupid enough to put their music warez or whatever they call them are going to get smacked. Good. Just becuase you disagree with the concept of IP doesn't mean you can ignore the law.
I've noticed that you don't like to keep all the issues in mind when you reply to things. For instance, the RIAA did not go to court and charge a student with having illegal MP3s on the school network. The RIAA did not call the FBI and request an investigation. The RIAA did not get a search warrant to go through the school's networked computers and check for illegal material. These are all due process of the law. The RIAA instead threatened (implied) lawsuits and scared the schools into doing police work on the students. It wasn't ever shown that many of these persons had illegal MP3s; if they were .MP3, they got deleted. Read the news.
Silly me, I thought private companies had the right to make whatever agreements between each other they wanted to. If a company is making products that don't fail some legal test, why shouldn't they go to court to stop those items from being distributed?
Your comment is almost true -- but out of context again. The question was:
What is their case for demanding that products with legitimate, legal uses be pulled from the market or crippled because they "might" be used to illegally copy copyrighted material?
... which you didn't answer. There is no implied agreement here between companies. The question is whether one company or association (the RIAA) can force another "free" company (as you pointed out) such as, for instance, Diamond multimedia, to change their software because it -MIGHT- be used to pirate music. Isn't it illegal for the user of the software to use it illegally? There isn't even a clause on my hammer at home telling me to not use it to smash peoples' car windows.
It's illegal to copy commercial music and distribute it to those who have no right to that music. It doesn't matter if the tools are available; you're just not allowed to do it.
- Michael T. Babcock <homepage> -
Re:Bad Euros.
Did you decide to take this quote out of context on purpose? The original text mentions that this proposed embargo is because of possible NSA involvement -- oh, wait, the NSA IS a branch of government.
- Michael T. Babcock <homepage> -
Re: Good euros
I don't mind being considered an intelligent consumer. I do mind you claiming that any of the people I've done consulting for in the last two years can think for themselves when it comes to processor choices. You do realize, of course, that most of them don't even know what a Pentium is
... as opposed to just being some chip thingy in a computer thingy that does Word faster, right? Anyway, I think maybe its a good idea for a government who feels that another is being bad to inform its consumers this way. You can't buy house paint with lead in it. Why not? Why not let consumers decide if they want lead in their paint? Why not let the market decide if mercury in your water is bad for you or not? Why not let people decide if they want to buy irradiated food or apples washed with deadly chemicals? Because consumers want experts to protect them against potentially dangerous practices of unscrupulous persons and corporations who are capable of anything given their mass wealth. Consider the US constitution; why does it allow for personal use of firearms? Specifically, there is provision for a rogue government and the need to protect one's self ... but there is encouragement to have militias so that this can be done by those trained to do so properly. If it comes down to it, I won't buy Pentiums with serial numbers, but I'd rather have my government (Canada) decide that the NSA or CIA involvement is a bad thing and protect consumers from those issues. I don't personally feel that processor serial numbers are anywhere near as serious as mercury in water -- the point is that a generalistic statement like yours needs to be considered in context!
- Michael T. Babcock <homepage> -
Re:PGP != PKI
I take it that you don't understand the web of trust model. The idea that PGP implements is to allow anyone to trust anyone else, regardless of their 'status' -- that is, there are no certificate authorities. However, because I can trust your signed keys, I can inherently trust a key that has your signtature attached. In fact, I could trust someone's key because it was signed by someone whose key was signed by someone whose key was signed by you (who I trust). This kind of 'friend trusts friend trusts friend' model is very useful if a large number of people are using the system. Within a closed system such as a company, keys get signed quickly because of close proximity to each other. Each of these people may know and trust a few other people on the Internet (say, 3). If there are 50 people at a company using PGP who have all signed each others' keys and trust those people to sign others' keys responsibly (two different trust settings), then there is an automatic infrastructure of 150 people trusting each other through the company people (not including the latter group).
With high percentages of PGP/GPG usage, there is a good web of trust established and a public key infrastructure in the hierarchial sense is not needed. However, a trusted "root" authority can establish themselves (Thawte is one such authority) and sign PGP keys, allowing everyone to trust their key, and implicitly trust others' keys.
Both models are usable under a web of trust model; don't discount PGP so easily.
- Michael T. Babcock <homepage> -
Re:Sounds like this thing needs mirroring
Of course not, we (being a Canadian myself) don't ever pepper spray students who are peacefully protesting a foreign government official.
Mind you, I think the students were out of line, but so was the RCMP.
I'd still like to see 8 dozen copies of this site go up (anyone remember the stupid Barbie site that was brought down a couple years ago?) if its not a hoax.
- Michael T. Babcock <homepage> -
Re:www.Athabascau.ca
On a side note, one of the computers people at my school is taking a Masters in distance education from Athabasca. He says its really good, and quite well put together. One of the big things to look for is how good their online software is for interaction. I've contemplated using a Slashdot based site as an interactive forum even for students
...
- Michael T. Babcock <homepage> -
Re:Wrong
I assume you haven't read any of the references I gave in my initial comment.
Undocumented DOS is the best reference.
Watch the Caldera suit against MS for many more. Search news.com or another older online news source for references if you wish. Search through your old PC World magazines. There are many references to the tactics MS used to make other DOS operating systems not work with the Windows "platform" so they could then finalise the pressure with an integrated platform. Note: Windows 95 is no more integrated than Dos 6.1 and Windows 3.11 ... just that its on one installation CD and Microsoft decided to combine its revenues into one product with the initial Caldera (and other) law suits at the time.
- Michael T. Babcock <homepage> -
Re:Boy, this is delusional
This proves exactly nothing. I'm amazed that Tim O'Reilly, of all people, would think that when you buy commercial software you are actually paying for the bits on the CD. Of course you aren't! Those bits cost next to nothing intrinsically. You are paying for the license, which in turn is the software company's way of recouping the salaries of its developers, testers, and managers.
I understand your point, but it sounds like you missed all the hubbub that was going around when this came to light. In fact, Microsoft plainly claims that you can buy two products (aside from Windows 9x): Windows NT server and Windows NT workstation. It also claims (and has claimed since several years ago) that IIS, DNS, etc. are FREE software that comes with the inherently better underlying operating system.
The discovery of the two "I'm not NT server" registry entries made a lot of people upset because it turned out that bit for bit, NT workstation and server are the same product. Microsoft WAS indeed selling the included daemons for the $800 difference between workstation and server. The biggest issue was that workstation has a client limit (5 clients I believe) that Microsoft says is inherent in its lower performance and NT -should- be used for anything larger. The fact of the matter is, they just put licensing restrictions into effect to prevent you from using more than 5 users on it.
Netscape server was often sold on the cost basis that although ISS was 'free' with NT server, Netscape server + NT workstation cost less than NT server and you could have a better webserver platform (a completely serperate argument). MS insisted through many many documents that Workstation was not -capable- of running a webserver and NT -should- be used instead. They didn't have a licensing problem here, just that they weren't making the money off of selling NT server (with its "free" and competing web server software). Netscape lost a lot of webserver sales because of this.
In fact, it didn't matter if you used the registry entries at all ... they only enable a very few features from workstation to server ... the fact was that many people (especially journalists) were shocked that Microsoft had been lying about the "inherently lower performance" of workstation.
... anyway ... Linux is better, cost/performance wise, even if you DO buy a distribution.
- Michael T. Babcock <homepage> -
Re:Asinine...
The reason we label these as old tricks for Microsoft is because they have intentionally caused these incompatibilities before. The question here is whether this service pack's incompatibilities with Lotus Notes are intentional or not. Microsoft won't give us the right answer, just like they hid the tying of DOS 6.x and Windows 3.x from everyone.
They released Windows compliance specificiations for other DOS makers, but didn't tell them that Windows actually checked a couple obscure memory mappings (where the character map was for one) to see if it was running on Microsoft's DOS product or not. If not, they put up a BSOD warning which scared people away from non-MS DOS products, eventually allowing them to do a full integration product, Windows 95 (DOS 7.0 + Windows 95 shell).
Read my comments about Microsoft in the earlier 90's re: DOS / Windows, etc.
If indeed Slashdot were making blind accusations, this would be bad. However, knowing their history, it's not a bad guess.
- Michael T. Babcock <homepage> -
Re:Fscking socialists
It helps that half of Germany has been through strong communist rule (with all the secret spying and interference in business that that includes). From that kind of perspective, you can see that they would value their freedom more than many Americans who don't remember living under tyrany.
- Michael T. Babcock <homepage> -
both personal opinions
I consider both statements to be personal opinions and devoid of universal truth.
I consider the Gnome system to be wonderful, UI wise, compared to Windows. I would attribute 80% of that to the included Enlightenment Window Manager, not to Gnome in general. I consider GTK+ to be eons ahead of MFC for making quick and dirty programs with that actually look good.
As a beginner, which would I prefer? Windows maybe ... for now. Which do I like for what I use my computer for? Gnome of course (I'm using it right now ...).
I don't think this poster has the right to claim that the other person was arrogant any more than the latter had the right to say that Gnome all-in-all makes Windows look crude. Windows has some points that shine in comparison to Gnome (the Gnome configuration panel sucks ... bad!, but Windows' themeability sucks worse ;-) ).
The fact that Miguel is doing something new is interesting ... and through the few E-mail contacts I've had with him as a programmer, I'm impressed with his abilities, so I'll be watching closely.
- Michael T. Babcock <homepage> -
Tomauri products
Tomauri has some great products, some of which I have used with success. To start, get good cables for your monitor such as Tomauri's "high density coax-style monitor cables"
... SKU 5378, 5373 or 5375 for 6, 10 or 15' lengths (from Blue Diamond). Prices from ~ $15 each ... (maybe less if you know someone -- I can't give you the real cost price because of the regulations as a reseller).
The switch box I recommend most is the Masterview 4 way automatic file server switch box. It can set you back about $225 but the features are great: It has built in monitor/mouse/keyboard emulation (so the PC senses each as being connected even if they aren't) and uses keyboard hotkeys to switch between machines. Supports both PS/2 and AT keyboards. SKU: 3074.
PS, Tomauri SKUs can be ordered from most wholesalers like Merisel and Ingram as well. If you're talking to your local computer sales people, just tell them the Tomauri #'s and ask for a price. You could always get your own account by calling 1-877-4-TOMAURI
- Michael T. Babcock <homepage> -
Re:Gov't should leave MS alone
A lot could be done for Windows' speed and stability if 3rd parties were able to put their DOS's underneath it
... but who's going to pay for a new 'DOS' when you "Don't need DOS to run Windows 9x" as all the idiot techs I worked with in 1995 quoted happily.
Sure you need a DOS, its just bundled with Windows now. And that's why they're in court with Caldera ... there are others that could get a piece out of them for that one too (Norton).
- Michael T. Babcock <homepage> -
Re:They got what they asked for
How long have you been involved in the desktop Internet scene? I was installing Internet for thousands of clients in 1993 for $20 (CAN) a month (200 hours access). We distributed Netscape 1.0 and then 1.1N
... if it hadn't been for Netscape, we wouldn't have had a service to sell. Internet explorer 1.0 (and even 2.0) weren't worth the 'free'ness they were bundled for. Sure, MS caught up and I'm not here for the browser wars, but Netscape made the Internet what it is today, not Microsoft. Sure, they've fallen behind the times, but many of us remember the Netscape that got us really moving. Yes, there were browsers before; there was even Lynx. However, those didn't push the limits like Netscape did ... if you can't think of reasons Netscape should be honoured, you just weren't watching what happened.
- Michael T. Babcock <homepage> -
Re:Not too surprising
Have you actually looked at the authors of the software you're discussing on Freshmeat? Lots of 'us' don't have CS majors at all
... some of 'us' are only hobbiest programmers that write code for fun. Admittedly, some of this code sucks ... but that's why open source works for 'us'.
- Michael T. Babcock <homepage> -
Re:Gnome vs. KDE! Competition is the American Way
Don't automatically call me people as though I somehow represented all of Slashdot. I see this happen a lot. Read my User Info page and see what I've posted.
I don't claim that competition is necessary. In fact, if Microsoft actually valued its customers and technology as much as it does its money, it would be quite plausible for me to "like" Microsoft because they would be making better software. As it is, I think competition is good in that circumstance because they aren't attempting to innovate and move quickly with technology but are falling behind (often) what hardware can do and aiming for the lowest common denominator.
Distributed.net does a very good job of what they do and if they released their source code at all to the public (maybe not the part that does the network interaction), it would be very easy to add to it. Modularity would be even better. But why not communicate with them about it in the first place? On a more personal note, I help program GICQ. There are about a dozen Linux ICQ clients, all based on each others' source code to some degree. Sure, lots is good ... to some extent ... but when everyone just starts their own project instead of helping someone else's, they all move slowly.
Just my $0.02 worth.
- Michael T. Babcock <homepage> -
Re:WILL NEVER WORK!
If my key is compromised and I have to generate a new on who signs my key, internic, verisign?
I envisioned (I thought clearly) something more along the "web of trust" lines. Smaller ISPs have their keys signed by their larger ISPs (arranged somehow -- not too hard) and larger ISPs can do the same between each other for the sake of most protocols. This would be easier than what DNSSEC is going to require in some circumstances.
Since I envisioned a generic library for any type of daemon (with several options, of course, but one underlying security model), many of these systems don't have to be signed by many people at all -- security is desired, so those who want it arrange it.
Meaningful encryption would push the 512 byte limit of dns udp packet to a much smaller payload, making the use of tcp for common dns activities necessary thereby tremendously reducing dns performance.
I'm not sure what you're trying to say here. That if I encrypt data it grows? This isn't very true (except for the need for headers, etc.). If the stream is encrypted before being packaged (UDP, TCP), the encryption negotiation would be a packet or two every hour or so and the actual encrypted communications would be the same size, just encrypted. The only added data would be hashes for authentication.
You'd want to precompress (to a small degree) of course, seeing as compression is less CPU intensive (in some cases!) than encryption. You end up encrypting less data then and the hash is tacked on to that.
Meaningful encryption would cause CPU load - period. Imagine the com root servers having to encrypt every answer. This would probably end up requiring an Origin 2000 and remember that 8.2.2 isn't able to take advantage of SMP.
Again, I don't care if BIND can (currently) make use of SMP or not; my ideal would be it taking advantage of a library which itself could be SMP capable. I don't buy the CPU intesity argument though because with the exception of high end routers, most machines aren't processing enough data of the type discussed here for the encryption to be significant.
I may be wrong ... but in my experience (quite a bit, but I'm not a cryptographer or an NSA guy, just an implementer), there are cyphers sufficient for burst transmissions of this kind that are quite CPU non-intensive.
For instance, consider a system where a new session key is negotiated by two time servers every hour. The encryption needs to be such that it can't be broken in under an hour or two (a week would be a nice goal here). Simple DES would be sufficient for most cases (although not necessarily best).
Of course, the whole point here is that I had not intended to fully flesh out how such a system would run. I do not consider myself fully capable of doing such without heavily referring to how others have already done it (ahem, patents).
Mind you, in the case of DNS and your mention of 1000 requests per second, I don't buy that convenience is more important than security in the long run. Computers are becoming much much faster every year. Put a pair of SMP Athlon 700's on a network to handle DNS and caching for a company where previously there were quad P-Pro 200's. Makes for a significant upgrade at about the same cost as the original investment but with significant head room, especially to handle the amount of encryption I'm talking about.
My concept of a good system for this would be to have multiple cyphers chosen based on the amount of data being sent to a given location (whether a "stream" can/will be held open to them) and the length of time needed for security.
I don't see a DNS packet needing to be authentic for more than an hour or so ... ditto for NTP and ICP requests.
SMTP and IMAP would need much stronger hashes to make sure E-mail was authentic (especially large companies who go to trial ;-) ) ... etc.
I think it's "doable" and I'd love to see someone like NAI, SSH or Bruce S. fiddle with it seriously.
- Michael T. Babcock <homepage> -
Re:WILL NEVER WORK!
If my key is compromised and I have to generate a new on who signs my key, internic, verisign?
I envisioned (I thought clearly) something more along the "web of trust" lines. Smaller ISPs have their keys signed by their larger ISPs (arranged somehow -- not too hard) and larger ISPs can do the same between each other for the sake of most protocols. This would be easier than what DNSSEC is going to require in some circumstances.
Since I envisioned a generic library for any type of daemon (with several options, of course, but one underlying security model), many of these systems don't have to be signed by many people at all -- security is desired, so those who want it arrange it.
Meaningful encryption would push the 512 byte limit of dns udp packet to a much smaller payload, making the use of tcp for common dns activities necessary thereby tremendously reducing dns performance.
I'm not sure what you're trying to say here. That if I encrypt data it grows? This isn't very true (except for the need for headers, etc.). If the stream is encrypted before being packaged (UDP, TCP), the encryption negotiation would be a packet or two every hour or so and the actual encrypted communications would be the same size, just encrypted. The only added data would be hashes for authentication.
You'd want to precompress (to a small degree) of course, seeing as compression is less CPU intensive (in some cases!) than encryption. You end up encrypting less data then and the hash is tacked on to that.
Meaningful encryption would cause CPU load - period. Imagine the com root servers having to encrypt every answer. This would probably end up requiring an Origin 2000 and remember that 8.2.2 isn't able to take advantage of SMP.
Again, I don't care if BIND can (currently) make use of SMP or not; my ideal would be it taking advantage of a library which itself could be SMP capable. I don't buy the CPU intesity argument though because with the exception of high end routers, most machines aren't processing enough data of the type discussed here for the encryption to be significant.
I may be wrong ... but in my experience (quite a bit, but I'm not a cryptographer or an NSA guy, just an implementer), there are cyphers sufficient for burst transmissions of this kind that are quite CPU non-intensive.
For instance, consider a system where a new session key is negotiated by two time servers every hour. The encryption needs to be such that it can't be broken in under an hour or two (a week would be a nice goal here). Simple DES would be sufficient for most cases (although not necessarily best).
Of course, the whole point here is that I had not intended to fully flesh out how such a system would run. I do not consider myself fully capable of doing such without heavily referring to how others have already done it (ahem, patents).
Mind you, in the case of DNS and your mention of 1000 requests per second, I don't buy that convenience is more important than security in the long run. Computers are becoming much much faster every year. Put a pair of SMP Athlon 700's on a network to handle DNS and caching for a company where previously there were quad P-Pro 200's. Makes for a significant upgrade at about the same cost as the original investment but with significant head room, especially to handle the amount of encryption I'm talking about.
My concept of a good system for this would be to have multiple cyphers chosen based on the amount of data being sent to a given location (whether a "stream" can/will be held open to them) and the length of time needed for security.
I don't see a DNS packet needing to be authentic for more than an hour or so ... ditto for NTP and ICP requests.
SMTP and IMAP would need much stronger hashes to make sure E-mail was authentic (especially large companies who go to trial ;-) ) ... etc.
I think it's "doable" and I'd love to see someone like NAI, SSH or Bruce S. fiddle with it seriously.
- Michael T. Babcock <homepage> -
Re:it's been done before
When I take class notes, I often have thoughts of my own that I know aren't part of the class lecture itself
... I mark these with a "self:" in a circle next to the paragraph so that I know for future use (especially essays in that course) whether to credit the prof when citing my notes, or whether to simply state the thoughts as my own.
I know full well that most everything I write down from class is owned by my school. The school pays the teachers good money for the actual copyright on their lectures and also pays them for the lecture time itself. That way, the school can hand off the notes to a new teacher or to other teachers (most often) without the first teacher being upset about the information sharing.
- Michael T. Babcock <homepage> -
Re:Daemon security in general
You of course realise that SSH2 is Open Sourced
... and that its very secure. The idea here is to generate keys at install time, not compile-time.
If a key is generated at compile-time, it can be stolen ... the only time to do it that way is if you're not distributing binaries and you generate the key for inclusion in the compiled program yourself (with an included function) before compilation.
./configure
make key
.oOo.oOo.oO...
src/keyfile.h completed
make all
make install
... tada ;-)
The idea I had was to have these keys actually signed by an external program (that uses the same authentication toolkit library) so that you can say, "yes, I trust these keys to be from the daemons at the root servers" and if you geet root server replies from anyone else, you ignore or negative cache that they're bad ;).
- Michael T. Babcock <homepage> -
Elaboration
As some have pointed out, there are many protocols that are "open" that could be updated to do something like what I've mentioned. Just to put a few more of my thoughts down on virtual paper (PS, the thoughts are GPL'd if that's possible; you can use them for any GPL project
:).
I'd like to see something along the lines of an authenticaed ident server as a necessary part of this protocol. It wouldn't be a daemon running (like ident) to identify callers, but the daemon (like BIND) connecting to the remote daemon would identify who it is (SSH2 style) and what machine it is running on (also SSH2 style).
Why identify both the machine and the daemon? Because a daemon could be loaded up by a (bad) user and run on a different port, linked against the authentication library and attempt to send bad data "out there" to other machines. In this way, the daemon itself would have identity information either created at compile-time (and linked in via header) or some other method. Of course, the daemon would have to be unreadable by anyone but root (or its own username), but that's ok, right?
Sending data over a secure connection works just fine if you don't want people snooping, but authenticating a daemon requires more than that. In the case of DNS, one of the big factors is authenticating that the DNS server you've connected to is indeed who it claims to be.
XNTP3 does this as well (in a basic form) if you want to create time peers that authenticate off each other.
RFC ideas anyone?
- Michael T. Babcock <homepage> -
Daemon security in general
It would be nice if some of the real security people out there would work toward a standard of intersystem daemon security. An SSH (SECIP) style public-key with trust (signed keys -- like PGP/GPG) system (in a library) that could be linked against by all those making daemons. BIND could link against it to authenticate messages it sends and receives, so could PING (for those of us who don't like pingfloods) and X.
Each daemon is starting to add its own security (Cyrus IMAP has several options) and they aren't inter-compatible. If there were a common library they were based on, it could be improved upon by all parties involved.
Hate to point out one of the greatest benefits of open source -- shared library code that you can modify -- and also one we are bad at actually doing.
- Michael T. Babcock <homepage> -
Daemon security in general
It would be nice if some of the real security people out there would work toward a standard of intersystem daemon security. An SSH (SECIP) style public-key with trust (signed keys -- like PGP/GPG) system (in a library) that could be linked against by all those making daemons. BIND could link against it to authenticate messages it sends and receives, so could PING (for those of us who don't like pingfloods) and X.
Each daemon is starting to add its own security (Cyrus IMAP has several options) and they aren't inter-compatible. If there were a common library they were based on, it could be improved upon by all parties involved.
Hate to point out one of the greatest benefits of open source -- shared library code that you can modify -- and also one we are bad at actually doing.
- Michael T. Babcock <homepage> -
Re: Submit to Distributed
Why didn't the authors instead submit their code to distributed.net to have the distributed.net client process this new project? We all have distributed.net's clients (in the sense that one exists for just about anyone). Another group trying to make a name for themselves but not being inter-compatible
... would be nice if people joined projects instead of creating new ones for a change.
- Michael T. Babcock <homepage> -
Re:Ugh...more e-mail
I don't know where you come from, but I've been begging companies to send me my information by E-mail instead of paper form for a long time now. Why should we live in an "almost paperless" society working with computers and generate paper to communicate all the time?
I use electronic banking on the Internet to pay my bills and I shop online for books and movies as well. I don't like getting spam in my mail (physical) or in my E-mail, but the E-mail stuff is easier to delete ... and I don't have to take out the garbage afterward.
And why, pray tell, do you think that the fine print will change on contracts just because they're sent electronically? Most people don't read the Xerox contract when they buy a new fax machine that states "New shall be defined as any new or used or remanufactured part that Xerox deems suitable for sale" ... I'd just rather have an electronic version of my warrantees to file on floppy (or ZIP) than paper versions lying around somewhere.
I hope other Slashdotters are with me on this one, or we're a bunch of digital hypocrites.
- Michael T. Babcock <homepage> -
Re:Hmmmm
Actually I found it interesting the way the judge phrased the facts on web apps and appliance computers -- they may very well succeed, but there is no proof of that yet, and others have failed.
- Michael T. Babcock <homepage> -
Re:sgi's xfs?
Which brings up the question of keeping support for multiple filesystems. MINIX has so little overhead that many still use it on floppies. The Squid caching group is working on a new VFS to put on top of the Unix filesystems it is installed on because they are so bad at handling large numbers of small files. It would be great to have an open filesystem standard for a small-file reliable filesystem for such things as caching and user document partitions. Then use ext2/3 for binary/library directories, etc. There shouldn't be a "one size fits all" filesystem we aim toward, should there? Complexity may be a pain some days, but you don't have to expose the average person to this, just those wishing for optimised performance (just like not everyone needs to know how to use RAID).
- Michael T. Babcock <homepage> -
Re:then again..
A CODEC is CODE DECODE shortened up
... a short form for an algorithm that encodes and decodes a stream of data (in this case).
For instance, Real Player G2 will see a stream and notice that it doesn't know what to do with, say, RealFlash 2.0 data, so it downloads the RealFlash2.0 "CODEC" to handle it.
They both do this.
IMHO, this is what all software should do.
- Michael T. Babcock <homepage> -
Re:"'The Government' ... has nothing to do with it
That's why suicide is illegal...Huh? Why is suicide illegal?
It just is -- ask someone who knows more than you (hey, call a random phone number, maybe?)
"The Government" simply speaking, has nothing to do with it,
... Hey, that's all I'm asking for!
Of course, if you'd quoted the whole comment, your next comment would look pretty stupid ...
It seems that the general public
... sympathises (sic) on the side of "pro-choice"... It is not about sympathy, it's about choice. Who decides, you or the government? I say you.
First, go look up "sympathise" in your Oxford English -- it doesn't mean to feel bad for someone (as you probably assumed it does), it means to have similar beliefs to. Also, "sympathise" is not incorrect spelling but Canadian and UK spelling. As for the comment looking stupid, the government is elected in the US and Canada so their is no separation of "the government" or "the people" deciding. The people decide everything -- including laws enforced by government. Murder is illegal because the majority of people in the country think it is. If they didn't, the laws would change. The law isn't there to make people conform to the minority view but to enforce the majority view. If you don't understand law, don't argue this point any more -- you're looking bad already, your views aside.
Oh, and the fun one:
..that the mother "owns" the baby inside her which is labelled a "fetus" because it is still attached to her womb.
How old are you? I'm fairly certain your age is measured from the moment of birth and not before. Until being born, you were a fetus. I know that it's hard to accept
Until what age is a person a child? 18 (most states and provinces). How about a baby? Usually 2 years old by definition. A senior? 65 some places. A fetus? After conception and before birth. Was the fetus in your mother's womb you? I guess not. Otherwise it was a person ... you. Funny how you never handled my single mother murdering her infant question ...
How do people between the ages of thirteen and nineteen killing infants relate to fetal life inside a woman?
I stated how. If a child is born three months premature, 6 months after conception, in a teen's bedroom, and she lets it die by exposure, poisons it, etc. It is murder. If she had an abortion the day before, it wasn't.
You tell me the difference. The difference is exactly what I said, in TRUE terms (not interpreted thoughts on the matter) that is, whether the baby is attached to the mother physically. It has never occured to you that the sack a fetus grows in seperates it almost entirely from its mother except by the umbilical (sp?) cord? And yet you would argue that it is simply a part of the mother's body ... not its own body or a new person yet ... after all, it can't talk, just kick and think (don't even think of arguing that a semi-developed brain in a fetus isn't active).
Re: Capitalist society vs. Communism:
For the last time, Communists use the fact that Captialist society has low moral standards as propaganda against captialism. The aborting of unborn infants is one such low moral standard used. If you couldn't understand that thought-process, you might want to stay out of these discussions.
You must have a lot of pent up aggression against your mother. Freud would definitely take an interest. Are you upset that she didn't abort you and instead allowed you to come into a world where other people will do things which you find morally wrong, but yet they still have a right to do?
An intelligent psychoanalyst would be more inclined to realise my anger at others for being unwilling to value human life in all its forms. That is, that society at large ignores those persons that are inconvenient -- babies unwanted, street persons, drug addicts, etc.
Moral wrongness vs. rights. If you want to bring God into something, you just defined his interaction here. We do indeed have the right before a Christian God (if you wish to believe in him of course) to do anything we please. He has made this very clear. However, he also tells us which things are not beneficial and which are wrong. Just because you're allowed to do something doesn't make it right -- sometimes in fact, its the lesser of two evils ... but many allowable things are, indeed wrong.
If you think doing what you want is fine ... go help the BC (Canada) judge who decided possession of child pornography is legal.
- Michael T. Babcock <homepage> -
Re:Remember libc5 vs. GNU libc?
That and GCC vs. EGCS and PGCC
... somewhat still ongoing, but merging.
- Michael T. Babcock <homepage> -
Re:Gov't should leave MS alone
Actually, many of us don't like the stuff MS makes. The whole point is not that "everyone went out and bought into Windows 95 because they wanted to" but that there was no longer an upgrade path available outside Windows.
Remember that in 1994, PCs weren't as popular as they are now and that in 1992 they were even less so. In those days, most PC owners were somewhat technically savvy and many of them used non MS products like DR DOS and Desqview/X. Many used DOS extender utilities and the like. Most of those people even paid for these programs but MS (illegally) added code to Windows 3.1 to make it claim incompatibility with anything other than MS DOS, forcing people to switch. Go buy a copy of Undocumented DOS if you don't believe me.
Microsoft does not always succeed because they make good products -- they make good products, yes. That is because they hire young programmers with innovation in their minds. That is because they have lots of money and they got that money by being naughty in the past. Now they're trying to hide that.
- Michael T. Babcock <homepage> -
Re:No great surprise
Of course, the DOJ didn't have to issue a press release. The court findings of fact are the DOJ's press release because they agree with them. Microsoft gets to spew worthless words while the peoplof the USA have spoken through their elected and appointed court system.
- Michael T. Babcock <homepage>